The present invention relates to microprocessor supervisory circuits. More particularly, the invention relates to a class of microprocessor supervisory circuits known as watchdog circuits.
Supervisory circuits are known. The function of a supervisory circuit is to ensure that the circuit being monitored by it works as expected. If the monitored circuit fails, the supervisory circuit then takes a predefined course of action to either remedy the failure, to limit the potential damage, or to simply warn. Watchdog circuits, representing a special class of supervisory circuit, are often employed to monitor software execution on a microprocessor or microcontroller (hereinafter "monitored processor"). When software-related failure on the monitored processor is detected, the watchdog circuit responds.
FIG. 1 illustrates a simple watchdog circuit configuration. In FIG. 1, there is shown a monitored circuit 100, representing the circuit/system being monitored by a supervisory circuit 104. Typically, monitored circuit 100 includes one or more microprocessors or microcontrollers 102. Supervisory circuit 104 includes a watchdog circuit 106. A watchdog input pin 108 couples watchdog circuit 106 to monitored processor 102.
In operation, watchdog circuit 106 monitors software execution on monitored processor 102. Typically, programmers of the software that executes on monitored processor 102 would include in its codes commands that periodically pulse a specified OUT pin 110 on the monitored processor if the software executes properly. OUT pin 110 may represent, in one embodiment, an input/output (FO) pin or a bus line of monitored processor 102. Since watchdog input pin 108 of watchdog circuit 106 is coupled to OUT pin 110, watchdog input pin 108 is also periodically pulsed by the externally pulsed signal that is generated when the software executing on monitored processor 102 executes properly.
Each time the watchdog input pin 108 gets pulsed, the watchdog timer within watchdog circuit 106 gets reset to zero and starts counting again, using, for example, an oscillator circuit. In the event that watchdog input pin 108 is not pulsed by the end of a predefined watchdog timeout period, e.g., when the software executing in monitored processor 102 is in an endless loop or experiences software failures, the internal watchdog timer within watchdog circuit 106 times out, thereby generating a watchdog fault condition. As long as a pulse is received before the expiration of each predefined watchdog timeout period, the watchdog fault condition is not generated.
In one embodiment, the presence of the watchdog fault condition is manifested by the assertion of a watchdog output signal on watchdog output pin 112. This watchdog output signal may then be provided to monitored processor 102 to cause, for example, a non-maskable interrupt for servicing the watchdog fault condition. The watchdog output signal may also be used to indicate that a watchdog fault condition has occurred by, for example, setting a flip-flop. The watchdog output signal may also be input into a reset circuit to reset the system being monitored, e.g., monitored circuit 100.
In some situations, it is desirable or even necessary to disable the watchdog function performed by watchdog circuit 106. For example, some software may be written without providing for commands to periodically pulse watchdog input pin 108. To avoid the continual generation of the watchdog fault condition on an otherwise operative monitored circuit, it is desirable in this case to simply disable the watchdog circuit. As a further example, monitored circuit 100 may at times be intentionally placed in a sleep mode, which effectively suspends software execution in monitored processor 102. In this case, it is undesirable to continually generate the watchdog fault condition when monitored circuit 1130 behaves as desired.
In the prior art, there exists many schemes for disabling the watchdog function, using a variety of circuits within watchdog circuit 106. FIG. 2 shows, for illustration purposes, a watchdog circuit 106 having a watchdog disabling circuit 200. When watchdog input pin 108 is pulsed by the monitored circuit (not shown in FIG. 2), this externally pulsed signal will be detected by a transition detector circuit 202, whose output is processed via an OR gate 204 to provide a watchdog reset signal on a conductor 206. In the present example, the watchdog circuit is reset when conductor 206 is high. As mentioned earlier, this watchdog reset signal resets the internal watchdog timer in watchdog circuit 106 if watchdog input pin 108 is pulsed before the expiration of the predefined watchdog timeout period.
When the externally pulsed signal is absent, e.g., when monitored circuit 100 is in a sleep mode or monitored circuit 100 causes the I/O pin 110 to become high impedance, the watchdog pin 108 floats and is no longer pulsed by this externally pulsed signal. Since watchdog input 108 now floats, internal voltage divider 210 pulls watchdog input pin 108 to a predefined voltage level. The value of this predefined voltage level depends on the values of resistor R1 and R2 and the respective voltage levels to which these resistors are coupled. In the present example, resistors R1 and R2 are coupled to 5 volt Vcc and ground respectively. Resistor R1 has a value of 320 k.OMEGA., and resistor R2 has a value of 180 k.OMEGA.. Together, they cause watchdog input pin 108 to servo to a potential level that is about one-third Vcc.
Comparators 212 and 214 compare the potential at watchdog input pin 108 with reference voltages V1 and V2. Comparators 212 and 214 represent, in one case, simple CMOS inverters that have skewed trip points. In the present example, V1 is at about 2.7 volts, and V2 is at about 1 volt When the potential level at watchdog input pin is about 1/3 Vcc, comparators 212 and 214 pull the inputs of AND gate 216 high, effectively latching conductor 218 high. In this manner, the watchdog reset signal on conductor 206 is continuously latched high (via OR gate 204), thereby preventing the generation of the watchdog fault condition at the expiration of the predefined watchdog timeout period. As is apparent, the watchdog function is effectively disabled.
Although the watchdog disabling circuit of FIG. 2 accomplishes its purpose, there is room for improvement. For example, when watchdog input 108 floats and is pulled to the above-mentioned predefined voltage level by internal voltage divider 210, current is consumed thorough resistors R1 and R2. In one case, about 10 .mu.A of current is consumed when watchdog input pin 108 floats.
Further, when the operating voltage of the monitored circuit is lowered, e.g., in modem processors that operate at 3.3 volts or even lower, it becomes increasingly difficult to distinguish, via internal voltage divider 210 and comparators 212 and 214, the more closely spaced apart voltage thresholds at the watchdog input pin. For example, to ascertain whether watchdog input pin 108 is at the predefined value (e.g., after being pulled up by internal voltage divider 210), comparators with high tolerances are required when the operating voltage of monitored circuit 100 drops. As is known, comparators that have higher tolerances are more complicated and therefore more difficult to fabricate. In some cases, more sophisticated comparator schemes must be employed to differentiate among the close thresholds. As can be appreciated, this undesirably increases manufacturing complexities and costs.
FIG. 3 shows a watchdog circuit 106 which employs a different watchdog disabling scheme. In FIG. 3, an extra pin 300 is required to disable the watchdog function. Instead of driving the reset signal directly when the watchdog circuit detects the watchdog fault condition, watchdog circuit 106 causes a watchdog out signal to be asserted on pin 300. If this pin 300 is coupled to a manual reset (MR) pin, the assertion of the watchdog out signal will cause the reset signal to be asserted when the watchdog fault condition is generated. However, if pin 300 is disconnected from the manual reset (MR) pin, e.g., by removing a jumper therebetween, the reset signal will not be asserted irrespective whether there exists a watchdog fault condition. When the pin 300 is so disconnected, the watchdog function is disabled.
The extra pin requirement to disable the watchdog function represents a disadvantage of this prior an method. As IC packages become smaller and smaller, fewer pins can be provided per IC chip. As such, pins are at a premium, and it is often not possible to have an extra pin to facilitate the disabling of the watchdog function.
In view of the foregoing, what is desired is improved methods and apparatus for disabling the watchdog function of a watchdog circuit when the circuit it monitors no longer generates an externally pulsed signal. To conserve power, it is further desired that the improved watchdog disabling circuit disable the watchdog function in a power efficient manner.